Summary
USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the
corresponding fix for PyJWT on Ubuntu 26.10.
Original advisory details:
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. (CVE-2026-102266)
Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to cause PyJWT
to disclose sensitive information. (CVE-2026-102267)
It was discovered that PyJWT incorrectly recognized certain PEM
representations. An attacker who knew the public key could possibly use
this issue to forge authentication tokens. (CVE-2026-102268)
Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when
performing HMAC verification. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102271)
It was discovered that PyJWT did not properly handle certain JWK keys
prefixed with a byte-order mark. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102272)
Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK
containers when performing HMAC verification. An attacker who knew the
public key could possibly use this issue to forge authentication tokens.
(CVE-2026-102273)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.10 | pyjwt | 2.13.0-1ubuntu1 |
Vulnerabilities 6
-
Critical 9.1CVE-2026-102268 Public exploit
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…
-
High 7.4
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…
-
High 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…
-
High 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …
-
High 7.4
PyJWT BOM Bypass
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…
-
High 7.4
PyJWT accepts public JWK containers as HMAC secrets
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…
References
-
report
https://ubuntu.com/security/CVE-2026-102266
-
report
https://ubuntu.com/security/CVE-2026-102267
-
report
https://ubuntu.com/security/CVE-2026-102268
-
report
https://ubuntu.com/security/CVE-2026-102271
-
report
https://ubuntu.com/security/CVE-2026-102272
-
report
https://ubuntu.com/security/CVE-2026-102273